nsp found vulnerability

mikenicholson / passport-jwt

Passport authentication using JSON Web Tokens

MIT License

1.96k stars 213 forks source link

nsp found vulnerability #147

Closed oskaryil closed 6 years ago

oskaryil commented 6 years ago

node security check just found a new vulnerability in passport-jwt which goes down to jsonwebtoken > joi > hoek. https://nodesecurity.io/advisories/566

daraghking commented 6 years ago

v8 of jsonwebtoken dropped the Joi dependency. I ran the tests on an updated dependency (v8.1.1) and they all pass.

This might be useful: https://github.com/auth0/node-jsonwebtoken/wiki/Migration-Notes:-v7-to-v8

thiagobustamante commented 6 years ago

Any news? It is breaking my build, once nsp is failing

thiagobustamante commented 6 years ago

@themikenicholson, Can I send a Pull Request to fix it?

mikenicholson commented 6 years ago

Fixed by 4.0.0 release. Closing.

Apologies for taking so long to get to this.